CCIE Security v4.0 Practice Lab

Date: Jul 15, 2014

In this practice lab to help in your preparation for the CCIE Security exam, Natalie Timms focuses on initializing and configuring the Cisco Adaptive Security Appliance (ASA) in both single- and multi-context modes.

Section 1: Perimeter Security and Services

Securing the perimeter around important networks and devices is a fundamental part of network protection. In this section, you are asked to implement firewall services that include not only traditional features, such as Network Address Translation (NAT) and traffic inspection, but also secured routing features. This section focuses on initializing and configuring the Cisco Adaptive Security Appliance (ASA) in both single- and multi-context modes. Connectivity through perimeter devices must be verified before moving on to other exercises in this guide.

Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode

ASA1 must be configured as a multi-context firewall using a shared outside interface. In addition, context c1 and the admin context will be using VLANs for logical segregation on a physical interface. The logical placement of ASA1 is shown in the network topology presented in Diagram 2 in Part I.

Table 1-1 through Table 1-6 outline the initialization requirements.

Table 1-1 Administration

Hostname	ASA1
Enable Password	cisco

Table 1-2 Context Admin

Physical Interface	Logical Name	VLAN	config-url
GigabitEthernet0/2.2	mgmt (management traffic only)	102	disk0:/admin.cfg

Table 1-3 Context c1

Physical Interface	Logical Name	VLAN	config-url
GigabitEthernet0/0	outside	80	disk0:/c1.cfg
GigabitEthernet0/2.1	inside	101

Table 1-4 Context c2

Physical Interface	Logical Name	VLAN	config-url
GigabitEthernet0/0	outside	80	disk0:/c2.cfg
GigabitEthernet0/1	dmz	90
GigabitEthernet0/3	inside	100

Table 1-5 Context Initialization Details

Context	Interface	IP Address/Mask	Nameif	Security Level
admin	GigabitEthernet0/2.2	192.168.1.20/24	mgmt	100
c1	GigabitEthernet0/0	10.50.80.20/24	outside	0
	GigabitEthernet0/2.1	192.168.2.20/24	inside	100
c2	GigabitEthernet0/0	10.50.80.30/24	outside	0
	GigabitEthernet0/1	10.50.90.20/24	dmz	50
	GigabitEthernet0/3	10.50.100.20/24	inside	100

Table 1-6 Routing Details

Context	Type	Network Prefix	Next Hop
c1	Default	0.0.0.0/0	10.50.80.6
c2	Default	0.0.0.0/0	10.50.80.6
admin	Default	0.0.0.0/0	192.168.1.5
c2	Static	10.10.0.0/16	10.50.100.2

Use names and addresses exactly as outlined. Remember that names are case sensitive.

Notes

To validate your configuration, ensure that all interfaces in all contexts are up. You should ensure that Internet Control Message Protocol (ICMP) is permitted through each context to test connectivity and routing to the major subnets in the topology. You may use permit icmp any any for this purpose. Refer to Part I of this guide for information on the network addressing used in the topology.
You might need to add or modify the configuration of switches and routers to ensure you have full connectivity.
Some subnets might not be accessible until the configuration of ASA2 (see Exercise 1.2) and the Cisco IPS sensor (Exercise 2.1) is complete.
The subinterface used for management traffic (admin context) must connect to inside secure hosts for management purposes only.

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode.”

Exercise 1.2: Configure Routing and Basic Access on ASA2

In this exercise, ASA2 should be configured in single-context routed mode with support for Open Shortest Path First (OSPF). Table 1-7 through Table 1-10 provide the necessary configuration details. Use names exactly as they are shown; remember that they are case sensitive. You will not need to change any of the OSPF parameters on neighboring routers. Refer to Diagram 2 and Diagram 3 in Part I for device placement, addressing, and routing details.

Table 1-7 Administration

Hostname	ASA2
Enable Password	cisco

Table 1-8 Interface Initialization Details

Interface	IP Address/Mask	Nameif	Security Level
GigabitEthernet0/0	10.50.50.20/24	outside	0
GigabitEthernet0/2	10.50.40.20/24	inside	100
GigabitEthernet0/3	10.50.30.20/24	dmz	50

Table 1-9 Static Routing Details

Interface	Type	Network Prefix	Next Hop
dmz	Static	10.3.3.0/24	10.50.30.3
dmz	Static	10.4.4.0/24	10.50.30.4

Table 1-10 OSPF Routing Details

Interface	Area	Network Prefix	Network Mask
outside	0	10.50.50.0	255.255.255.0
dmz	1	10.50.30.0	255.255.255.0
inside	2	10.50.40.0	255.255.255.0

Notes

To validate your configuration, ensure that all interfaces are up. You should ensure that ICMP is permitted through the firewall to test connectivity and routing to the major subnets in the topology. Refer to Part I of this guide for information on the network addressing used in the topology.
You might need to add or modify the configuration of switches and routers to ensure you have full connectivity.
Some subnets might not be accessible until the configuration of ASA1 (in Exercise 1.1) and the Cisco IPS sensor (in Exercise 2.1) is completed.

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.2: Configure Routing and Basic Access on ASA2.”

Exercise 1.3: Configure IP Services on ASA1

This exercise has four tasks that build on the initial configuration of ASA1 Exercise 1.1. You may use any names for configuration elements such as access lists or objects, unless otherwise specified. Note that because the version of software currently running on ASA1 is post 8.3, the NAT configuration tasks will require the use of objects. Refer to Diagram 2 and Diagram 3 in Part I for device placement and addressing details.

Task 1: Configure Network Object NAT
Task 2: Configure Twice NAT
Task 3: Configure and Troubleshoot NTP Services Using Authentication
Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1

Task 1: Configure Network Object NAT

Use network object NAT to translate 10.50.90.5/32 on R5 to 10.50.80.50/32 in the appropriate context. This translation must allow bidirectional communication.

Task 2: Configure Twice NAT

Using Twice NAT, create a policy that will translate network 10.50.100.0/24 to the range 10.50.80.100–10.50.80.150 if the destination is 10.50.50.0/24. Translation for this task is unidirectional.

Task 3: Configure and Troubleshoot NTP Services Using Authentication

Network Time Protocol (NTP) on ASA1 using authentication is required with the NTP master service, which is partially configured on SW1 as follows:

SW1# show run | begin ntp
ntp authentication-key 1 md5 cisco
ntp source Vlan102
ntp access-group peer 1
ntp master 2

Complete the configuration and troubleshoot any issues using the following outputs to verify your solution:

ASA1# show ntp associations detail
192.168.1.5 configured, authenticated, our_master, sane, valid, stratum 2

ASA1# show ntp status
Clock is synchronized, stratum 3, reference is 192.168.1.5

Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1

Enable support for the ipv6ip tunnel configured between the tunnel endpoints 10.50.80.6 (R6) and 10.50.90.5 (R5). This configuration will be important for the completion of Exercise 5.1.

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.3: Configure IP Services on ASA1.”

Exercise 1.4: Configure IP Routing Security on ASA2

There are two tasks in this exercise that will focus on configuring the ASA2 to support dynamic routing protocols. Refer to Diagram 3 for routing protocol and addressing details.

Task 1: BGP Connectivity Through the ASA2

External Border Gateway Protocol (eBGP) has been preconfigured on R7 and R6 in Autonomous Systems 107 and 106, respectively. The BGP peering function cannot establish a session between these two routers through ASA2. Configure a solution that will enable the BGP peers to establish a connection. The following outputs can be used to verify your solution:

R6# show ip bgp
BGP table version is 3, local router ID is 172.18.106.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
  r RIB-failure, S
Stale, m multipath, b backup-path, x best-external, f RT-Filter, a additional-path
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.18.106.0/24  0.0.0.0                  0         32768 ?
*> 172.18.107.0/24  10.50.40.7               0             0 107 ?

R7# show ip bgp
BGP table version is 5, local router ID is 172.18.107.7
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
  r RIB-failure, S
Stale, m multipath, b backup-path, x best-external, f RT-Filter, a additional-path
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.18.106.0/24  10.50.70.6               0             0 106 ?
*> 172.18.107.0/24  0.0.0.0                  0         32768 ?

Task 2: OSPF Authentication for Routing Update Security

MD5 authentication is required in OSPF area 2. Configure a solution for this area only, and ensure that OSPF routing information is still correctly exchanged between neighbors.

Use the key cisco123.

The following outputs will verify your solution:

R7# show ip ospf neighbor

Neighbor ID     Pri   State         Dead Time   Address       Interface
10.50.50.20       1   FULL/BDR      00:00:32    10.50.40.20   GigabitEthernet0/1

ASA2# show ospf neighbor inside

Neighbor ID     Pri   State         Dead Time   Address       Interface
172.18.107.7      1   FULL/DR       0:00:38     10.50.40.7    inside


ASA2# show ospf
Area 2
        Number of interfaces in this area is 1
        Area has message digest authentication

R7# show ip ospf
    Area 2
        Number of interfaces in this area is 2 (1 loopback)
        Area has message digest authentication

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.4: Configure IP Routing Security on ASA2.”

Section 2: Intrusion Prevention and Content Security

This section covers tasks applicable to some specialized Cisco appliances, the Intrusion Prevention Sensor (IPS) and the Web Services Appliance (WSA). Both devices will be initialized and deployed into the network topology as shown in Diagram 1 and Diagram 2 in Part I. The single IPS appliance will be logically partitioned using various deployment modes of operation to service distinct traffic flows in the network. The WSA will handle redirected traffic of interest via Web Cache Communication Protocol (WCCP) from the Cisco ASA. It is important to verify whether traffic is correctly flowing through the appliances before moving on to other exercises in the lab.

Exercise 2.1: Initialize and Deploy the Cisco IPS Sensor Appliance

The exercise has four tasks.

You will be required to initialize the Cisco Intrusion Prevention Sensor (IPS) appliance and make it accessible from its management interface, and then deploy the sensor in three different interface modes: Inline VLAN pair, Inline Interface pair, and Promiscuous.

The Lab Topology diagram (Diagram 2 in Part I) depicts three IPS devices; however, only one physical IPS sensor exists in the network. This requires you to pay special attention to the switches in the topology to ensure switch ports are correctly configured (switchport modes, VLANs, and so on) to support each of the three logical/virtual sensors (refer to Diagram 1 in Part I).

Use names and details exactly as they appear in the tables.

Task 1: Initialize the Cisco IPS Sensor

Use the parameters in Table 1-11 to complete the task of initializing the sensor.

Table 1-11 Initialization Parameters

Parameter	Settings
Hostname	IPS
Management	Configure the command and control Management0/0 interface in VLAN 101
Sensor IP address	192.168.2.100/24
Default gateway	192.168.2.20
Sensor ACL	192.168.2.0
Telnet	Enable Telnet management

Verify the Cisco IPS sensor configuration using the following:

The username and password for the Cisco IPS console are ciscoips and 123cisco123. Do not change them. Use the console to initialize the Cisco IPS sensor appliance using the details in this table.
Ensure that the Management0/0 interface is up and functioning (refer to the Lab Topology diagram). You can modify the Cisco Catalyst switch configuration if required.
Ensure that the Cisco IPS sensor can ping the default gateway:
```
IPS# ping 192.168.2.5
```
Ensure that the following ping and Telnet connection is successful from SW1:
```
SW1# telnet 192.168.2.100
```

Task 2: Deploy the Cisco IPS Sensor in Inline VLAN Pair Mode

Configure the Cisco IPS sensor appliance for the Inline VLAN pair as shown in Table 1-12.

Table 1-12 Inline VLAN Pair Parameters

Parameter	Settings	Virtual Sensor Name
Physical interface	GigabitEthernet0/2	vs0
Inline VLAN pair	Vlan1 70 (VLAN70)
	Vlan2 50 (VLAN50)

Task 3: Deploy the Cisco IPS Sensor in Inline Interface Pair Mode

Configure the Cisco IPS sensor appliance for the Inline Interface pair as shown in Table 1-13.

Table 1-13 Inline Interface Pair Parameters

Parameter	Name	Settings	Switch VLANS	Virtual Sensor Name
Interface Pair	ipair	GigabitEthernet0/0,	60	vs1
		GigabitEthernet0/1	80

Task 4: Deploy the Cisco IPS Sensor in Promiscuous Mode

Configure the Cisco IPS sensor appliance for promiscuous mode on GigabitEthernet 0/3 and assign it to virtual sensor vs2.
For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 2.1: Initialize and Deploy the Cisco IPS Sensor Appliance.”

Exercise 2.2: Initialize the Cisco WSA

The Cisco WSA should be pre-initialized via the CLI with an IP address of 192.168.2.50:8080 and connected via SW1 in VLAN101 as shown in Diagram 2 in Part I.

Using a browser, connect to the WSA and complete the initialization of the Cisco WSA using the system setup wizard as shown in Figure 1-1. The information to be used for system setup is outlined in Table 1-14. Aside from the username and password values, other information in the System Information parameters can be anything.

Figure 1-1 WSA System Setup Wizard

Table 1-14 WSA Initialization Parameters

Parameter	Settings
Hostname	wsa.cisco.com
Interfaces	Management (M1) to be used for data and management
IP address	192.168.2.50/24
Default gateway	192.168.2.20
System Information	username: admin; password: ironport; email: fred@foobar.com ; timezone: America/United States/Los Angeles (this will vary)
NTP server	192.168.2.5
DNS	192.168.2.25
L4 Traffic Monitoring	Duplex TAP:T1 (In/Out)

Connection information: http://192.168.2.50:8080; username: admin; password: ironport

Accept all other defaults.

From ASA1/c1, verify whether you can ping the M1 interface of the Cisco WSA:

ASA1/c1# ping 192.168.2.50

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 2.2: Initialize the Cisco WSA.”